The worst offenders here are those who host their jQuery and offer it to others on a domain that is also being used to host other web applications. For eg. com

The worst offenders here are those who host their jQuery and offer it to others on a domain that is also being used to host other web applications. For eg. company xyz.com is a hosting company, but it also offers jQuery and other javascript at cdn.xyz.com. A client of the company at client.xyz.com is setting a cookie for its users but sets it as xyz.com. Now everybody else that is using cdn.xyz.com will also see those cookies. One example of this is the cloudflare CDN[1]. All of their clients and all of their hosted javascript is on the same domain. Test it out by checking the cookies your browser sends along[2], I see random Techcrunch cookies (they used cloudflare on a site) [1] http://www.cdnjs.com/ http://www.cdnjs.com/ [2] http://cdnjs.cloudflare.com/ajax/libs/backbone.js/0.5.3/backbone-min.js http://cdnjs.cloudflare.com/ajax/libs/backbone.js/0.5.3/back...